{
  "@id": "urn:uuid:c164d025-4f67-4c9e-9a77-13e59001c25c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T15:34:19.282169+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.0",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.0"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2014-10064 affects version 6.15.0 of qs.",
      "vulnerability": {
        "name": "CVE-2014-10064"
      },
      "action_statement": "Vulnerability CVE-2014-10064 affects version 6.15.0 of qs."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.0",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.0"
          }
        }
      ],
      "timestamp": "2026-11-03T15:13:02.714408+00:00",
      "status_notes": "Vulnerability CVE-2014-7191 does not affect version 6.15.0 of qs. not_affected \u2014 CVE-2014-7191 (DoS via large sparse arrays) is not present in qs 6.15.0. The vulnerability was fixed upstream in July 2014 with commits that added arrayLimit (default 20), parameterLimit (default 1000), and overflow handling to prevent sparse array allocation. These fixes were shipped in the upstream v6.15.0 release before TuxCare onboarded it. The target contains all three defense mechanisms: ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-7191"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-7191 (DoS via large sparse arrays) is not present in qs 6.15.0. The vulnerability was fixed upstream in July 2014 with commits that added arrayLimit (default 20), parameterLimit (default 1000), and overflow handling to prevent sparse array allocation. These fixes were shipped in the upstream v6.15.0 release before TuxCare onboarded it. The target contains all three defense mechanisms: ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.0",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.0"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2017-1000048 affects version 6.15.0 of qs.",
      "vulnerability": {
        "name": "CVE-2017-1000048"
      },
      "action_statement": "Vulnerability CVE-2017-1000048 affects version 6.15.0 of qs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.0",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.0"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2022-24999 affects version 6.15.0 of qs.",
      "vulnerability": {
        "name": "CVE-2022-24999"
      },
      "action_statement": "Vulnerability CVE-2022-24999 affects version 6.15.0 of qs."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.0",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.0"
          }
        }
      ],
      "timestamp": "2026-11-03T15:34:19.282169+00:00",
      "status_notes": "Vulnerability CVE-2025-15284 does not affect version 6.15.0 of qs. not_affected \u2014 The target repository (qs version 6.15.0 at SHA 0cc057fa) is not affected by CVE-2025-15284. The vulnerability pattern\u2014missing `arrayLimit` enforcement for bracket notation (`a[]=value`)\u2014is not present in the target code. The upstream fix commit 3086902ecf7f088d0d1803887643ac6c03d415b9 by Jordan Harband (ljharb@gmail.com) was already included in the upstream release 6.15.0 before TuxCare onboar...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-15284"
      },
      "impact_statement": "not_affected \u2014 The target repository (qs version 6.15.0 at SHA 0cc057fa) is not affected by CVE-2025-15284. The vulnerability pattern\u2014missing `arrayLimit` enforcement for bracket notation (`a[]=value`)\u2014is not present in the target code. The upstream fix commit 3086902ecf7f088d0d1803887643ac6c03d415b9 by Jordan Harband (ljharb@gmail.com) was already included in the upstream release 6.15.0 before TuxCare onboar..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.0",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.0"
          }
        }
      ],
      "timestamp": "2026-10-14T22:18:00.169151+00:00",
      "status_notes": "Vulnerability CVE-2026-110816 affects version 6.15.0 of qs.",
      "vulnerability": {
        "name": "CVE-2026-110816"
      },
      "action_statement": "Vulnerability CVE-2026-110816 affects version 6.15.0 of qs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.0",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.0"
          }
        }
      ],
      "timestamp": "2026-10-27T07:05:00.167026+00:00",
      "status_notes": "Vulnerability CVE-2026-110910 affects version 6.15.0 of qs.",
      "vulnerability": {
        "name": "CVE-2026-110910"
      },
      "action_statement": "Vulnerability CVE-2026-110910 affects version 6.15.0 of qs."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.0",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.0"
          }
        }
      ],
      "timestamp": "2026-11-03T15:34:19.282169+00:00",
      "status_notes": "Vulnerability CVE-2026-2391 does not affect version 6.15.0 of qs. not_affected \u2014 The target qs 6.15.0 is NOT AFFECTED by CVE-2026-2391. The vulnerability concerns a bypass of arrayLimit enforcement when comma-separated values are parsed (with comma: true option). The upstream fix (commit f6a7abff by Jordan Harband) is present at lib/parse.js:134-139, enforcing arrayLimit on comma-parsed arrays by either throwing a RangeError or converting oversized arrays to objects. This f...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-2391"
      },
      "impact_statement": "not_affected \u2014 The target qs 6.15.0 is NOT AFFECTED by CVE-2026-2391. The vulnerability concerns a bypass of arrayLimit enforcement when comma-separated values are parsed (with comma: true option). The upstream fix (commit f6a7abff by Jordan Harband) is present at lib/parse.js:134-139, enforcing arrayLimit on comma-parsed arrays by either throwing a RangeError or converting oversized arrays to objects. This f..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.0",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-82417 affects version 6.15.0 of qs.",
      "vulnerability": {
        "name": "CVE-2026-82417"
      },
      "action_statement": "Vulnerability CVE-2026-82417 affects version 6.15.0 of qs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.0",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-82562 affects version 6.15.0 of qs.",
      "vulnerability": {
        "name": "CVE-2026-82562"
      },
      "action_statement": "Vulnerability CVE-2026-82562 affects version 6.15.0 of qs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.0",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-8723 affects version 6.15.0 of qs.",
      "vulnerability": {
        "name": "CVE-2026-8723"
      },
      "action_statement": "Vulnerability CVE-2026-8723 affects version 6.15.0 of qs."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.0",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.0"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability GHSA-crvj-3gj9-gm2p is a false positive for qs 6.15.0.",
      "vulnerability": {
        "name": "GHSA-crvj-3gj9-gm2p"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}